Ticket #31992: 31992.patch

wp-includes/formatting.php

@@ -2092 +2092 @@
  * @param bool   $strict   Optional. If set limits $username to specific characters.
  *                         Default false.
  * @return string The sanitized username, after passing through filters.
+ *
+ *
+ * changed 09.11.2020 by prfidneai
+ * to work with unicode usernames
+ * uses WP_IDN_USERNAME_REGEX && WP_IDN_STRICT_USERNAME_REGEX to check unicode username rules (current: latin + cyrillic)
  */
+
+
 function sanitize_user( $username, $strict = false ) {
-        $raw_username = $username;
+    $raw_username = $username;
         $username     = wp_strip_all_tags( $username );
         $username     = remove_accents( $username );
         // Kill octets.
-        $username = preg_replace( '|%([a-fA-F0-9][a-fA-F0-9])|', '', $username );
+    // prfidneai -  regex changed
+    $username = preg_replace( WP_IDN_USERNAME_REGEX, '', $username );
         // Kill entities.
         $username = preg_replace( '/&.+?;/', '', $username );
 
         // If strict, reduce to ASCII for max portability.
-        if ( $strict ) {
-                $username = preg_replace( '|[^a-z0-9 _.\-@]|i', '', $username );
-        }
-
+    // prfidneai -  regex changed
+    if ( $strict ) {
+        $username = preg_replace( WP_IDN_STRICT_USERNAME_REGEX, '', $username );
+    }
         $username = trim( $username );
         // Consolidate contiguous whitespace.
         $username = preg_replace( '|\s+|', ' ', $username );
@@ -3400 +3408 @@
  * @param string $email      Email address to verify.
  * @param bool   $deprecated Deprecated.
  * @return string|false Valid email address on success, false on failure.
+ *
+ * changed 09.11.2020 by prfidneai to work with EAI-mails
+ * uses WP_IDN_DOMAIN_REGEX for domain name regex (current: latin + Russian)
+ * uses WP_IDN_LOCAL_MAIL_REGEX for local part regex (current: latin + Russian)
  */
+
 function is_email( $email, $deprecated = false ) {
-        if ( ! empty( $deprecated ) ) {
+    if ( ! empty( $deprecated ) ) {
                 _deprecated_argument( __FUNCTION__, '3.0.0' );
         }
 
@@ -3435 +3448 @@
 
         // LOCAL PART
         // Test for invalid characters.
-        if ( ! preg_match( '/^[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]+$/', $local ) ) {
-                /** This filter is documented in wp-includes/formatting.php */
-                return apply_filters( 'is_email', false, $email, 'local_invalid_chars' );
-        }
+    // prfideai - regex changed
+    if ( ! preg_match( '/^['.WP_IDN_LOCAL_MAIL_REGEX.']+$/u', $local ) ) {
+        /** This filter is documented in wp-includes/formatting.php */
+        return apply_filters( 'is_email', false, $email, 'local_invalid_chars' );
+    }
 
         // DOMAIN PART
         // Test for sequences of periods.
@@ -3471 +3485 @@
                 }
 
                 // Test for invalid characters.
-                if ( ! preg_match( '/^[a-z0-9-]+$/i', $sub ) ) {
-                        /** This filter is documented in wp-includes/formatting.php */
-                        return apply_filters( 'is_email', false, $email, 'sub_invalid_chars' );
-                }
+        // prfideai -  regex changed
+        if ( ! preg_match( '/^['.WP_IDN_DOMAIN_REGEX.']+$/u', $sub ) ) {
+            /** This filter is documented in wp-includes/formatting.php */
+            return apply_filters( 'is_email', false, $email, 'sub_invalid_chars' );
+        }
         }
 
         // Congratulations, your email made it!
@@ -3614 +3629 @@
  *
  * @param string $email Email address to filter.
  * @return string Filtered email address.
+ *
+ * changed 09.11.2020 by prfidneai to work with EAI-mails
+ * uses WP_IDN_DOMAIN_REGEX for domain name regex (current: latin + Russian)
+ * uses WP_IDN_LOCAL_MAIL_REGEX for local part regex (current: latin + Russian)
+ *
  */
+
 function sanitize_email( $email ) {
-        // Test for the minimum length the email can be.
+    // Test for the minimum length the email can be.
         if ( strlen( $email ) < 6 ) {
                 /**
                  * Filters a sanitized email address.
@@ -3645 +3666 @@
 
         // LOCAL PART
         // Test for invalid characters.
-        $local = preg_replace( '/[^a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]/', '', $local );
-        if ( '' === $local ) {
+    // prfidneai - regex changed
+    $local = preg_replace( '/[^'.WP_IDN_LOCAL_MAIL_REGEX.']/u', '', $local );
+    if ( '' === $local ) {
                 /** This filter is documented in wp-includes/formatting.php */
                 return apply_filters( 'sanitize_email', '', $email, 'local_invalid_chars' );
         }
@@ -3684 +3706 @@
                 $sub = trim( $sub, " \t\n\r\0\x0B-" );
 
                 // Test for invalid characters.
-                $sub = preg_replace( '/[^a-z0-9-]+/i', '', $sub );
+        // prfidneai - regex changed
+        $sub = preg_replace( '/[^'.WP_IDN_DOMAIN_REGEX.']+/u', '', $sub );
 
-                // If there's anything left, add it to the valid subs.
+        // If there's anything left, add it to the valid subs.
                 if ( '' !== $sub ) {
                         $new_subs[] = $sub;
                 }
@@ -3700 +3723 @@
 
         // Join valid subs into the new domain.
         $domain = implode( '.', $new_subs );
-
+    // prfidneai -  punycode check & decode in domain name added
+    $domain = decode_punycode($domain);
         // Put the email back together.
         $sanitized_email = $local . '@' . $domain;
 
         // Congratulations, your email made it!
         /** This filter is documented in wp-includes/formatting.php */
-        return apply_filters( 'sanitize_email', $sanitized_email, $email, null );
+
+        return apply_filters( 'sanitize_email', $sanitized_email, $email, null );
 }
 
 /**
@@ -6040 +6065 @@
 
         return $color;
 }
+
+/*
+prfidneai
+Check is the domain name contents punycode
+Used in decode_punycode() function
+*/
+
+function is_punycode($string){
+    if (!strpos($string,'xn--')){
+        return true;
+    } return false;
+}
+
+/*
+prfidneai
+Punycode domain to IDN (Unicode) converter
+*/
+
+function decode_punycode($string) {
+    $url_parts=array();
+    $pref='';
+    $path='';
+    if(preg_match("/(http[s]?:\/\/)(xn--[a-zA-Z-0-9\.]+)([\S]+)/iu", $string, $url_parts)>0){
+        $pref=$url_parts[1];
+        $string=$url_parts[2];
+        $path=$url_parts[3];
+    }
+    if (is_punycode($string)){
+        return $pref.idn_to_utf8($string, IDNA_DEFAULT).$path;
+    }
+    return $pref.$string.$path;
+}

wp-includes/default-constants.php

@@ -16 +16 @@
  * @global string $wp_version The WordPress version string.
  */
 function wp_initial_constants() {
-        global $blog_id, $wp_version;
+        global $blog_id;
 
         /**#@+
          * Constants for expressing human-readable data sizes in their respective number of bytes.
@@ -99 +99 @@
         // Add define( 'SCRIPT_DEBUG', true ); to wp-config.php to enable loading of non-minified,
         // non-concatenated scripts and stylesheets.
         if ( ! defined( 'SCRIPT_DEBUG' ) ) {
-                if ( ! empty( $wp_version ) ) {
-                        $develop_src = false !== strpos( $wp_version, '-src' );
+                if ( ! empty( $GLOBALS['wp_version'] ) ) {
+                        $develop_src = false !== strpos( $GLOBALS['wp_version'], '-src' );
                 } else {
                         $develop_src = false;
                 }
@@ -412 +412 @@
                 define( 'WP_DEFAULT_THEME', 'twentytwentyone' );
         }
 
+
+}
+
+// PRF project - IDN domains for regexp
+
+// IDN domain names rules (without dots).
+// Using in sanitize_ functions
+// These are for latin and Russian domain names.
+// Can be extended to other scripts adding LGR to regex.
+
+
+// Local e-mail part user@ check rules.
+// Using in sanitize_email & is_email functions
+// These are for latin and Russian scripts.
+// Can be extended to others adding other allowed symbols to regex.
+
+if ( ! defined( 'WP_IDN_LOCAL_MAIL_REGEX' ) ) {
+    define( 'WP_IDN_LOCAL_MAIL_REGEX', 'А-Яа-яa-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-' );
+
 }
+
+if ( ! defined( 'WP_IDN_DOMAIN_REGEX' ) ) {
+    define('WP_IDN_DOMAIN_REGEX', 'а-яa-z0-9-');
+}
+
+// Usernames which use non latin scripts.
+// Using in sanitize_user function
+// These are for latin and Russian scripts.
+// Can be extended to others adding allowed scripts to regex.
+
+if ( ! defined( 'WP_IDN_USERNAME_REGEX' ) ) {
+    define( 'WP_IDN_USERNAME_REGEX', '|%([а-яА-Яa-fA-F0-9][а-яА-Яa-fA-F0-9])|u' );
+}
+
+if ( ! defined( 'WP_IDN_STRICT_USERNAME_REGEX' ) ) {
+    define( 'WP_IDN_STRICT_USERNAME_REGEX', '|[^а-яА-Яa-z0-9_.\-@]|iu');
+}
+ No newline at end of file